The HIPAA Business Associate Agreement (BAA), Explained for 2026
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/hipaa-business-associate-agreement
Last updated: October 13, 2026
A Business Associate Agreement (BAA) is the contract that makes a vendor legally responsible for the patient data it handles for you. No BAA, no patient data: that is the rule before any technology question. The HIPAA business associate agreement is also the most misunderstood document in healthcare IT. Practices think signing one makes them compliant. It does not. Vendors think a security page can replace one. It cannot. This guide covers what the law requires the contract to say. It covers who must sign one and who refuses. And it shows how to get one signed without a sales maze. It also gives you a 7-point check for a hosting BAA. Everything cites the rule itself, so you can check each claim.
We run HIPAA hosting for a living: we sign the BAA within 24 hours of signup, on plans from $229 a month. We sell this, so weigh our view with that in mind.
TL;DR: Quick answer
A vendor that creates, receives, maintains, or transmits protected health information (PHI) for you is a business associate (45 CFR § 160.103). You need a signed BAA before it touches PHI (45 CFR § 164.308(b)).
The contract's required contents are set by law (45 CFR § 164.504(e)). They cover permitted uses, safeguards, breach reporting, subcontractor flow-down, patient access duties, termination, and return or destruction of PHI.
A signed HIPAA business associate agreement does not make anyone compliant by itself. It assigns legal duty. The safeguards still have to exist.
Operating without one is a violation on its own, no breach required. The 2026 penalty tiers run from $145 to $2,190,294 per violation.
Web hosts, email providers, schedulers, and form tools all sit inside this rule. Many mainstream vendors refuse to sign. That refusal is your answer.
A business associate must report a breach to you without unreasonable delay, and within 60 calendar days at most (45 CFR § 164.410). Many contracts set a shorter window.
We sign our HIPAA business associate agreement within 24 hours of signup, before patient data moves. It covers the servers and services we run.
What is a business associate agreement?
Start with the entities. HIPAA covers two groups. Covered entities are providers, health plans, and clearinghouses. A business associate is any outside company that handles PHI for a covered entity. The web host storing intake forms. The email service carrying patient messages. The billing platform. The IT contractor with server access. A cloud EHR vendor is a business associate too, as our guide to HIPAA compliant EHR hosting explains. The BAA is the written contract between the two. It binds the vendor to HIPAA's rules. It also gives the government a direct line of enforcement against that vendor. Since the 2013 Omnibus Rule, business associates carry direct liability of their own. The HIPAA business associate agreement is what puts that chain in writing.
Who needs one, and how far down the chain it goes
The test is function, not job title. Does the vendor create, receive, maintain, or transmit PHI on your behalf? Then a HIPAA business associate agreement is required before the data flows (45 CFR § 164.308(b)). What makes information identifiable is set by the 18 HIPAA identifiers.
The chain does not stop at one hop. Your vendor's vendors need one too. A subcontractor that touches PHI signs with the business associate above it, on the same terms.
Two groups sit outside the rule. Vendors that never touch PHI need nothing. And pure carriers, like an internet service provider that only moves encrypted traffic, can fall under the narrow conduit exception. A web host does not qualify for that exception, because a host stores your data.
Encryption does not change the answer. HHS cloud guidance says a cloud provider that stores only encrypted electronic PHI, with no decryption key, is still a business associate. In its words, lacking the key "does not exempt" the provider from that status. A host that says it cannot read your data still owes you a HIPAA business associate agreement.
Whether your own site is in scope is covered in who needs HIPAA-compliant hosting. One honest note: a site that holds no patient data needs no BAA host at all. Ordinary hosting is fine for it, as HIPAA hosting vs regular hosting explains.
What the law requires the contract to say
The required contents are not up for negotiation. They are listed in 45 CFR § 164.504(e). A real HIPAA business associate agreement must contain each of these.
Required provision | What it means in practice |
|---|---|
Permitted uses and disclosures | The vendor may only use PHI for the contracted work, never in ways HIPAA forbids |
Safeguards | The vendor must apply the Security Rule's safeguards to electronic PHI |
Reporting | The vendor must report improper uses and breaches of unsecured PHI to you |
Subcontractor flow-down | Anyone the vendor hires who touches PHI must accept the same restrictions |
Patient rights support | The vendor must support access, amendment, and accounting duties (§§ 164.524, 164.526, 164.528) |
Termination | You may terminate if the vendor materially violates the contract |
Return or destruction | At the end, the vendor returns or destroys all PHI and keeps no copies |
HHS publishes sample provisions you can compare against any vendor's paper. When a vendor hands you a HIPAA business associate agreement, check it against this table. A contract missing the subcontractor flow-down or the return-of-data clause is not a compliant BAA, whatever its title says. If a vendor causes a breach, accidental HIPAA violation covers the response clock. In Texas, add a US-only storage clause too, because Texas SB 1188 requires health records to stay in the United States. The Florida health data storage law sets a similar location rule, and AHCA licensees attest to it at every renewal.
What a hosting BAA should cover: a 7-point check
The table above is the legal floor. Hosting adds practical questions the rule leaves to the contract. Use this check when a host sends you its HIPAA business associate agreement.
The services in scope. The contract should name what it covers: servers, storage, backups and snapshots, logs, and support access. If a service you use is missing, ask in writing.
The host's own subcontractors. Most hosts run on a larger cloud. That cloud needs its own BAA with the host (45 CFR § 164.308(b)(2), § 164.502(e)(1)(ii)). Ask which provider sits under the host.
The reporting window. How many days does the host have to report a breach or security incident? The legal ceiling is 60 calendar days.
Return or destruction at the end. The host must return or destroy your data at termination, if feasible (§ 164.504(e)(2)(ii)(J)). Confirm that this includes backups and snapshots.
Who signs, and when. Both sides sign before any patient data moves. A contract dated after launch leaves a gap you cannot fix later.
What is not covered. A host's HIPAA business associate agreement covers the host. Your email, SMS, form and EHR vendors each need their own.
Evidence you can keep. File the signed copy, its date and its scope with your risk analysis. Security Rule documentation must be kept for six years (§ 164.316(b)(2)(i)).
How we handle it: we sign the BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run.
Who does what under a hosting BAA
A HIPAA business associate agreement with a host splits the work. It does not hand all of it over. The table shows the split on a managed HIPAA hosting plan.
Area | The host (what our plans include) | You |
|---|---|---|
Server and operating system | We run your single-tenant AWS server. Root access is Enterprise only | Tell us what the site runs and what it collects |
Encryption at rest and in transit | Included on every plan | Keep exports, downloads and laptops encrypted on your side |
Firewall | Web application firewall and CloudFront CDN | Limit admin sign-ins to the people who need them |
Audit logs | Six-year audit logging | Review who has access, and remove accounts when staff leave |
Backups and restore tests | Tested encrypted backups, plus EBS snapshots kept for 7 days | Decide what gets restored first |
Your app, plugins and users | We host it. Our BAA covers the servers and services we run | Plugin choices, user accounts, passwords and what the site collects |
Your other vendors' BAAs | Outside our BAA | You sign with each email, SMS, form and EHR vendor |
Risk analysis and policies | A host is a business associate and owes its own | Your own written risk analysis and policies |
Every host draws this line a little differently, so get it in writing. If you run the server yourself, far more of the list moves to you, as managed vs self-managed HIPAA hosting shows.
How we handle it: the host column is included on every plan. The full split is on our scope of support page: what we run and what you run.
Breach reporting under a BAA: the 60-day ceiling
When a host has a breach, your clock depends on its clock. Under 45 CFR § 164.410, a business associate must notify the covered entity "without unreasonable delay". The outer limit is 60 calendar days after discovery. A breach counts as discovered on the first day the business associate knows of it, or should have known.
Your own duty runs separately. Section 164.404 gives a covered entity the same 60 calendar days to notify the affected individuals. A slow report from a vendor eats the time you need to investigate and write to patients. If the vendor acts as your agent, its knowledge can count as yours.
The contract has to carry the duty. A HIPAA business associate agreement must require the vendor to report any security incident it becomes aware of (§ 164.314(a)(2)(i)(C)). It must also require reports of improper uses and breaches of unsecured PHI (§ 164.504(e)(2)(ii)(C)). Sixty days is a ceiling, not a target. Many BAAs set a shorter window. Read that clause before you sign, and get the number of days in writing.
How we handle it: the reporting clause is in the HIPAA business associate agreement we sign with you. You can read it before any patient data moves.
What a BAA does not do
A HIPAA business associate agreement assigns duty. It does not perform the work. A signed BAA over an unencrypted server with shared logins is a lawsuit with a signature on it. Compliance still requires the safeguards: encryption, access controls, audit logs, backups, and a written risk analysis (45 CFR § 164.308(a)(1)(ii)(A)). That document is explained in our HIPAA risk analysis guide. This is the same both-halves rule we apply in every review: the contract half and the configuration half. One without the other fails. The contract is the credential; the badge is not, as HIPAA certified hosting explains. The five tests we use to score any vendor, BAA scope first, are in our ranking of the best HIPAA compliant hosting providers.
No BAA is a violation all by itself
This is the point practices learn during an audit instead of before one. Operating without a required BAA violates 45 CFR § 164.308(b) on contract grounds alone. No breach needs to happen. OCR asks for BAAs early in nearly every investigation. A missing one is one of the fastest findings it can make. Under the penalty amounts effective January 28, 2026, violations run from $145 to $2,190,294 each. The exposure sits quietly in ordinary tools. The practice website on a host with no BAA. The scheduler whose terms prohibit PHI. The personal inbox receiving intake forms. The automation tool that moves those forms into the EHR without a BAA. n8n Cloud is one example: it signs no BAA, so an n8n HIPAA compliant setup has to be self-hosted on a host that signs one. Every vendor in the patient-data path needs its own agreement. A missing one anywhere breaks the chain. For the website link in that chain, choose healthcare HIPAA hosting that signs the BAA before any PHI moves. If you are changing hosts, our step-by-step migration plan keeps coverage continuous from the first file to the last.
How we handle it: our HIPAA business associate agreement is signed before any patient data reaches our servers.
Who signs, and who refuses
The market splits cleanly. Specialist healthcare vendors sign as a matter of course. The big productivity suites sign on paid business plans: Google Workspace in the Admin Console, Microsoft 365 by default in its standard terms. Our guides to Google Workspace and HIPAA and Microsoft 365 and HIPAA cover the setup after the signature. The big clouds sign: AWS through Artifact, with Azure and Google Cloud on the same model. A signature is only the start there. Our guide to whether AWS is HIPAA compliant covers the rest.
And a long list of mainstream tools refuse or restrict. Most consumer website hosts sign nothing. Some vendors cover only one product, the way GoDaddy signs only for its Microsoft 365 email, not its standard hosting plans. A refusal is useful information. It tells you exactly where patient data cannot go, whatever the vendor's security page claims. Our vendor verdict library tests these one company at a time, always starting with the HIPAA business associate agreement question.
A HIPAA business associate agreement binds only the vendor that signs it. A practice with Google's BAA still needs one from its web host, as what the Google Workspace BAA does not cover shows.
How to get a BAA signed without the runaround
Here is the pain nobody warns you about. At many vendors, the HIPAA business associate agreement lives behind an enterprise sales process. A request form. An account review. A wait. Sometimes a plan upgrade. Meanwhile your project stalls. The data cannot flow until the signature exists. Three ways to shorten it. First, prefer vendors that include the BAA by default instead of gatekeeping it. Second, send the § 164.504(e) table above with your request, so the scope discussion happens once. Third, get the signed copy into your compliance records before launch, not after.
We built our own process around that pain: every plan includes the BAA, and our HIPAA compliant hosting starts at $229 per month. We sign it within 24 hours of signup, before patient data moves. Every plan also includes 4 hours of migration and configuration. We sell this, so weigh it as a disclosure. For a single practice site, our guide to HIPAA hosting for small businesses shows the whole setup.
If your worry is the vendors you already have, our client-side compliance review maps your whole vendor chain and shows which links have no agreement. Ask us anything about the BAA chain and you will get a direct answer.
Frequently asked questions
Is a business associate agreement legally required?
Yes. A HIPAA business associate agreement is required whenever a vendor handles PHI for a covered entity or another business associate. The requirement sits at 45 CFR § 164.308(b) and § 164.502(e). Operating without one is itself a violation, separate from any breach.
Can I use a BAA template?
HHS publishes sample provisions, and many vendors offer standard agreements built on them. A template is a fine starting point for a HIPAA business associate agreement when it contains every § 164.504(e) element. Have counsel confirm the scope matches the actual service, because the gaps live in the specifics.
Does a signed BAA make me HIPAA compliant?
No. The HIPAA business associate agreement assigns legal responsibility. Compliance still requires the safeguards, the policies, and a written risk analysis on both sides of the contract. The BAA is the first test, not the whole exam.
Who provides the BAA, the vendor or the practice?
Either side can supply the paper. In practice, large vendors use their own standard agreement and will not negotiate it. Specialist vendors sign quickly on either version. What matters is that every § 164.504(e) provision is present and the signed copy is in your records.
Do subcontractors need their own BAA?
Yes. A subcontractor that creates, receives, maintains, or transmits PHI signs a BAA with the business associate above it. The restrictions flow down the whole chain, and a missing link anywhere is a violation.
What should I do if a vendor refuses to sign?
Believe them, and keep PHI out of that tool. A refusal usually reflects the vendor's own terms of service. Move the patient-data function to a vendor that signs, or isolate the refusing tool so it never touches PHI.
Is a BAA required if the host only stores encrypted data?
Yes. HHS cloud guidance says a provider that stores encrypted electronic PHI without the key is still a business associate. The host still needs a HIPAA business associate agreement, and the Security Rule still applies to it.
How fast must a business associate report a breach?
Without unreasonable delay, and no later than 60 calendar days after discovery (45 CFR § 164.410). A HIPAA business associate agreement can set a shorter window, and many do. Check the clause before you sign.
Does my hosting provider's BAA cover my email, forms and scheduling tools?
No. A HIPAA business associate agreement binds only the vendor that signs it. A host's BAA covers the servers and services that host runs. Your email, form and scheduling vendors each need their own, unless the host runs that service for you.
Recap: HIPAA business associate agreement
To recap, the HIPAA business associate agreement is the contract that makes a vendor legally responsible for your patient data. The law sets its required contents at § 164.504(e): permitted uses, safeguards, breach reporting, subcontractor flow-down, patient rights support, termination, and return of data. Every PHI-touching vendor needs one, down the whole chain. It never substitutes for the safeguards, and its absence is a violation on its own. Check every vendor against the table, keep the signed copies, and treat a refusal as the honest answer it is. For a host, also check the scope, the reporting window and who does what.
If your host is the missing link, we sign our HIPAA business associate agreement within 24 hours of signup, before patient data moves. Request a quote for your practice, or talk through your app's stack with an engineer. You can also compare our current plans.
This article is general information, not legal advice. Regulatory citations reflect 45 CFR Parts 160 and 164 as of October 2026; the 2026 penalty tiers reflect the amounts effective January 28, 2026. Confirm your obligations with qualified counsel and base your safeguards on a written risk analysis. We sell HIPAA compliant hosting and compliance reviews. Reviewed October 2026.
Sources
45 CFR § 164.504(e) (business associate contract requirements): law.cornell.edu
45 CFR § 160.103 (business associate definition): ecfr.gov
45 CFR § 164.308(b) (BAA requirement): ecfr.gov
45 CFR § 164.502(e) (disclosures to business associates and subcontractors): law.cornell.edu
45 CFR § 164.314(a) (security incident reporting in the contract): law.cornell.edu
45 CFR § 164.410 (breach notification by a business associate): law.cornell.edu
45 CFR § 164.404 (breach notification to individuals): law.cornell.edu
45 CFR § 164.316(b) (documentation and six-year retention): law.cornell.edu
45 CFR § 102.3 (penalty table, amended by 91 FR 3665 on January 28, 2026): law.cornell.edu